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This listing of claims will replace all prior versions, and listings, of claims in the application:] 
Listing of Claims: 

1 . (Currently Amended) A method for analyzing access to a data communication network by a user, 
comprising: 

tracing traffic of said user via a computer, and identifying a group of networks with which 
said traffic is mainly handled, by defining relative autonomous systems and tracing the sequence of 
autonomous systems crossed by said traffic; the tracing including: 

- a first stage, to provide a list of paths of autonomous systems crossed by said traffic to 
reach each destination, and 

- a second stage, to aggregately elaborate said list of paths, outputting a tree representing all 
the paths of the autonomous systems crossed by the traffic of said user to reach each destination, 

wherein said first stage comprises the operations of inputting a file containing the IP 
addresses representing the sites most frequently visited by said user and performing a traceroute 
function for each destination site, by tracing the-a_path to reach each destination site via a 
transmission of a trac e rout e m e ssag e at a configurabl e fr e qu e ncy , and 

wherein said second stage comprises providing, in relation to the list of said autonomous 
systems crossed by said traffic of said user, at least one parameter including a percentage of use of 
the autonomous systems , and 

configuring a hardware probe to trace the traffic of said user and to provide information 
including: protocol-subdivision. IP address-subdivision, and a traffic matrix between the user and the 
network . 

2. (Previously Presented) A method as per claim 1, comprising determining the routing of said 
traffic on branches of said tree, and associating respective indicative values of the traffic that crosses 
the branches of said tree. 

3-4. (Canceled) 
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5. (Currently Amended) A method as per claim ^1, comprising configuring said hardware prob e s 
probe to determine at least one item selected from a group including: sites most frequently visited by 
the user, main networks to which the user addresses traffic, and the origin of who connects up to said 
user. 

6. (Currently Amended) A method as per claim 1, comprising setting software agents on th«-data 
communication network access routers to trace said user traffic. 

7. (Currently Amended) A method as per claim 6, comprising configuring said software agents to 
trace the traffic through the interface of tb«-a,router of said user to determine tbe-main traffic lines. 

8. (Currently Amended) A method as per claim 6, comprising configuring said software agents to 
analyze the operating status of th«-a_respective router in terms of CPU load and available memory. 

9. (Previously Presented) A method as per claim 6, comprising providing a target machine for the 
transfer of the statistics obtained by said routers. 

10. (Previously Presented) A method as per claim 1, comprising generating, as the result of said 
traffic tracing operation of said user, at least one parameter selected from a group including: 
destination networks of said traffic, percentage of traffic involved, and pertinent autonomous system. 

11. (Canceled) 

12. (Currently Amended) A method as per claim- comprising tracing said path as a sequence of 
autonomous systems crossed. 



13-14. (Canceled) 
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15. (Previously Presented) A method as per claim 1, wherein said second stage comprises 
generating a unique tree of paths of the autonomous systems crossed by the traffic of said user to 
reach all the destinations, wherein leaves of said tree are indicative of destination subnetworks of the 
traffic of said user. 

16. (Previously Presented) A method as per claim I, wherein the provided at least one parameter 
further includes at least one of a time value for passing through said autonomous systems and a hops 
value inside the autonomous system. 

17. (Previously Presented) A method as per claim 16, wherein said provided at least one parameter 
is expressed as an average value. 

18. (Previously Presented) A method as per claim 1, wherein said first stage comprises the operation 
of invoking for each IP address generated via said trace function, a remote service to obtain at least 
one item of information from a group including: name of the autonomous system to which the 
generated IP address belongs and the number of the autonomous system to which said generated IP 
address belongs. 

19. (Previously Presented) A method as per claim 18, wherein said remote service is the whois 
service of the databases RIBE, ARIN, APNIC. 

20. (Previously Presented) A method as per claim I, wherein said first stage comprises generating a 
data file including information selected from a group including: 

- order number of the autonomous system following the sequence of IP addresses provided 
by said trace function, 

- text name of the autonomous system, 

- identification number of the autonomous system. 

Page 4 of 13 



Appln.No.: 10/527,333 
Response dated October 12, 2010 
Office Action dated July 20, 2010 

- number of hops that a single tracing command has measured inside the autonomous system, 

and 

- time of permanence in the autonomous system measured by a single tracing command, 

21. (Previously Presented) A method as per claim 1, comprising performing a plurality of said 
tracing functions in parallel during said first stage. 

22. (Previously Presented) A method as per claim 1, wherein said second stage comprises storing 
information of correspondence between IP addresses and data relating to the autonomous systems. 

23. (Previously Presented) A method as per claim 1, wherein said second stage comprises 
generating leaves of said tree as an identification of destination subnetworks of the traffic of said 
user and relative branches as identifications of the autonomous systems crossed by the traffic. 

24. (Previously Presented) A method as per claim 1, wherein said second stage is performed in 
association with a central memory with a data structure that represents the paths generated in said 
first stage in the form of at least one aggregated list. 

25. (Previously Presented) A method as per claim 24, wherein said at least one aggregated list is 
identified as representing a variable number of autonomous system lists that share a conjmon 
maximum prefix. 

26. (Currently Amended) An apparatus for analyzing access to a data communication network by a 
user, comprising: 

a processor; and 

memory storing software code that, when executed by the processor, performs: 
tracing traffic of said user; 
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identifying a group of networks with which the traffic is mainly involved by 
identifying relative autonomous systems and tracing the sequence of autonomous systems crossed by 
said traffic; 

providing a list of paths of autonomous systems crossed by said traffic to reach each 

destination; 

aggregately elaborating said list of paths by outputting a tree representing all the 
paths of the autonomous systems crossed by the traffic of said user to reach each destination; 

providing, in relation to the list of said autonomous systems crossed by said traffic of 
said user, at least one parameter including a percentage of use of the autonomous systems;--and 

inputting a file containing IP addresses representing destination sites most frequently 
visited by said user and to perform a tracing operation for each destination site, by tracing th«-a_path 
to reach each destination site via a transmission of a trao e rout e messag e at a configurabl e frequ e noyi 
and 

configuring a hardware probe to trace the traffic of said user and to provide 
information including: protocol-subdivision. IP address-subdivision, and a traffic matrix between the 
user and the network . 

27. (Previously Presented) An apparatus as per claim 26, wherein the apparatus is configured to 
measure the routing of said traffic on branches of said tree and associate respective indicative values 
of the traffic crossing the branches to the branches of said tree. 

28-29. (Canceled) 

30. (Currently Amended) An apparatus as per claim 2826, wherein said hardware pFebes -probe a re 
is^configured to determine at least one item selected from a group including: sites most frequently 
visited by the user, main networks addressed by the user traffic, and origin of those who connect up 
to said user. 
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3 1 . (Previously Presented) An apparatus as per claim 26, comprising software agents on a data 
communication network access router to trace said traffic of the user. 

32. (Previously Presented) An apparatus as per claim 31, wherein said software agents are 
configured to trace the traffic through the interface of the router of said user by determining main 
traffic lines. 

33. (Previously Presented) An apparatus as per claim 31, wherein said software agents are 
configured to perform an analysis on the operating status of the respective router in terms of CPU 
load and available memory. 

34. (Previously Presented) An apparatus as per claim 31, comprising a target machine for receiving 
statistics obtained by said routers. 

35. (Previously Presented) An apparatus as per claim 26, wherein the apparatus is configured to 
generate as a result of said tracing operation of the traffic of said user at least one parameter selected 
from a group including: destination networks of said traffic, percentage of traffic involved, pertinent 
autonomous system. 

36. (Canceled) 

37. (Currently Amended) An apparatus as per claim ^26, wherein said apparatus is configured to 
trace said path as a sequence of autonomous systems that are crossed. 

38-39. (Canceled) ' 



40. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is configured to 
output a unique tree of autonomous systems paths crossed by the traffic of said user to reach all the 
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destinations, and wherein leaves of said tree are indicative of destination subnetworks of the traffic 
of said user. 

41. (Previously Presented) An apparatus as per claim 26, wherein the provided at least one 
parameter further includes at least one of a value of time of permanence inside said autonomous 
systems and a value of hops inside said autonomous systems. 

42. (Previously Presented) An apparatus as per claim 41, wherein the provided at least one 
parameter is expressed as an average value. 

43. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is configured to 
invoke for each IP address generated via said tracing a remote service to obtain at least one piece of 
information from a group including: name of the autonomous system to which the generated IP 
address belongs and number of the autonomous system to which the generated IP address belongs. 

44. (Previously Presented) An apparatus as per claim 43, wherein said remote service is the whois 
service of the databases RIBE, ARIN, APNIC. 

45. (Currently Amended) An apparatus as per claim 26, wherein said apparatus outputs a data file 
including information selected from a group including: 

- order number of the autonomous system following the sequence of the IP addresses 
provided by said tracing fiinotion o peration. 

- text name of the autonomous system, 

- identification number of the autonomous system, 

- number of hops that a single tracing command has measured inside the autonomous system, 

and 

- time of permanence in the autonomous system measured by a single tracing command. 
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46. (Currently Amended) An apparatus as per claim 26, wherein said apparatus is configured to 
perform in parallel a plurality of said tracing functions operations . 

47. (Previously Presented) An apparatus as per claim 26, wherein said apparatus contains a cache 
memory to store information of correspondence between IP addresses and data relating to the 
autonomous systems. 

48. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is configured so 
that leaves of said tree are destination subnetworks of the traffic of said user and relative branches of 
said tree are the autonomous systems crossed by the traffic. 

49. (Previously Presented) An apparatus as per claim 26, wherein said apparatus is associated to one 
central memory with a data structure that represents the paths generated by said apparatus in the 
form of at least one aggregated list. 

50. (Previously Presented) An apparatus as per claim 49, wherein said at least one aggregated list is 
identified as representing a variable number of autonomous system lists that share a common 
maximum prefix. 

51. (Currently Amended) A memory having stored thereon software code that, when executed, 
performs: 

tracing traffic associated with a user of a data communication network; 

identifying a group of networks with which said traffic is mainly handled;-aftd 

defining relative autonomous systems and tracing the sequence of autonomous systems 
crossed by said traffic, 

wherein the tracing includes: 

- a first stage, to provide a list of paths of autonomous systems crossed by said traffic 
to reach each destination, and 
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- a second stage, to aggregately elaborate said list of paths, outputting a tree 
representing all the paths of the autonomous systems crossed by the traffic of said user to reach each 
destination, 

wherein said first stage comprises the operations of inputting a file containing the IP 
addresses representing the sites most frequently visited by said user and performing a traceroute 
function for each destination site, by tracing the-a__path to reach each destination site via a 
transmission of a trac e rout e m e ssage at a configurabl e frequ e ncy , and 

wherein said second stage comprises providing, in relation to the list of said autonomous 
systems crossed by said traffic of said user, at least one parameter including the percentage of use of 
the autonomous systems , and 

configuring a hardware probe to trace the traffic of said user and to provide information 
including: protocol-subdivision. IP address-subdivision, and a traffic matrix between the user and the 
network. 
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